Tenda W15E CVE-2026-36806

Exploitation requires network reachability to the Tenda W15E's HTTP web-management interface and the ability to send a crafted HTTP request containing an oversized webAuthUserPwd parameter to the formModifyWebAuthUser endpoint; no credentials or user interaction are needed (CVSS PR:N/UI:N). Practical exploitation is limited by the fact that the web admin interface is LAN-facing by default on Tenda W15E units, so internet-based attack requires the operator to have enabled WAN/remote management or otherwise exposed the management port. The affected firmware is specifically W15E v15.11.0.10; other Tenda models or firmware revisions are not confirmed vulnerable from the supplied data. Impact is bounded to denial of service (A:H, C:N, I:N) - no data disclosure or code execution is claimed.

Signals are largely consistent but point to a narrow, lower-priority risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) cleanly matches a pre-authentication remote DoS - high availability impact, zero confidentiality or integrity impact - yielding 7.5. EPSS at 0.01% (2nd percentile) signals essentially no observed exploitation interest, and CISA has not added the CVE to KEV. The only public reference is a research repository (SemVulLLM) that appears to be an LLM-assisted vulnerability discovery dataset rather than a weaponized exploit, so 'no public exploit identified at time of analysis' applies. Realistic risk is meaningfully lower than the 7.5 base score suggests for two reasons: (1) router web management interfaces are normally LAN-bound by default, so AV:N applies only when remote management is enabled or the device is exposed; (2) the impact ceiling is a reboot, not code execution. Note: CWE-121 stack overflows on embedded devices sometimes escalate to RCE, but the description claims only DoS - that gap should be verified, as a confirmed RCE would substantially change priority.

An attacker who can reach the W15E's HTTP management interface - either on the LAN, on a guest segment with management exposed, or over the WAN if remote administration is enabled - sends a single crafted POST request to the formModifyWebAuthUser endpoint with an oversized webAuthUserPwd field. The overflow corrupts the httpd stack and crashes the management daemon (and typically the device), severing connectivity for downstream clients until the watchdog reboots the router; repeated requests yield a sustained outage. No public weaponized exploit is referenced, but the trigger is simple enough that a basic fuzzing script would reproduce it.